System and method for ensuring and managing situation awareness

ABSTRACT

Disclosed is a method and apparatus in which one or more data streams are sent to a computer and the data streams are sorted using a rule base into streams representative of events. The incoming data streams can be sent by hunter agents which search for specified types of data and forward the data to the computer. The incoming data stream can also be sent by a gatherer agent. The incoming data stream can also be incoming message traffic such as e-mail and other types of message traffic data. The incoming message traffic data is then sorted into event streams and can be displayed as event streams on a time line. Actions can be taken based upon specified events. Thus, events from disjointed sources can be sorted and displayed in a unified manner in which a user can readily and quickly know which events have occurred for a particular issue, such as a forest fire, hospital patient, etc.

FIELD OF THE INVENTION

[0001] The present invention relates generally to monitoring of datastreams, and more particularly, relates to providing situation awarenessby monitoring incoming data streams using a rule base. The incoming datastreams can be sent by hunter and gatherer agents or can be incomingmessage traffic.

BACKGROUND OF THE INVENTION

[0002] In government and commercial environments, human activity isdirected at understanding events in the real world and solving problemsbased on that understanding. This process is called Situation Awareness.

[0003] Rapid advances in computer technologies such as remote sensing,networking and data mining have in many cases overwhelmed organizationaland visualization tools used to interpret and respond to theinformation. As autonomous intelligent agents and subscription-based“push” technology becomes commonplace, this flood of information willincrease to tidal wave proportions.

[0004] The traditional response to these types of problems has been tobuild an individualized user environment tuned carefully to the needs ofthe specific problem to be solved. Each type of data processed orproduced by the system has a customized user interface dedicated toexploiting it.

[0005] While this approach can be effective, experience has shown thatit is also often expensive and high-risk to build such systems. A majorreason is that there is little opportunity for code reuse; the systemmust be built from the ground up. After becoming operational, thesesystems tend to be hard to adapt to changes in an organization'sworkflow process. These factors led us to seek “horizontal” systemarchitectures and end user environments; as the problem of data overloadbecomes part of everyone's experience, the need for such solutionsbecomes urgent.

[0006] Intelligent systems have been developed which are focused on theneeds of situation awareness users. These systems shared a commoninternal system architecture that significantly lowered systemdevelopment cost and risk. The flexibility of the architecture wasdemonstrated when it solved a wide variety of user problems includingterrorist activity analysis, low intensity conflict monitoring, militaryintelligence, and strategic threat assessment. However, the goal of ageneric user environment remained unrealized throughout this period.Some generic, reusable user tools could be developed, but most had to beclosely linked to the problem being solved.

SUMMARY OF THE INVENTION

[0007] It is, therefore, an object of the present invention to provide amethod and apparatus for monitoring and sorting incoming data streamsusing a rule base.

[0008] It is another object of the present invention to provide incomingdata stream which is sent by hunter agents and gatherer agents to apresence.

[0009] It is another object of the present invention to provide a rulebase which can sort the incoming data streams and provide a display ofan event stream on a time line.

[0010] These and other objects of the present invention are achieved bya method and apparatus in which one or more data streams are sent to acomputer and the data streams are sorted using a rule base into streamsrepresentative of events. The incoming data streams can be sent byhunter agents which search for specified types of data and forward thedata to the computer. The incoming data stream can also be sent by agatherer agent. The incoming data stream can also be incoming messagetraffic such as e-mail and other types of message traffic data. Theincoming message traffic data is then sorted into event streams and canbe displayed as event streams on a time line. Actions can be taken basedupon specified events. Thus, events from disjointed sources can besorted and displayed in a unified manner in which a user can readily andquickly know which events have occurred for a particular issue, such asa forest fire, hospital patient, etc.

[0011] The foregoing objects of the present invention are also achievedby a method for monitoring an incoming data stream for specified events.At least one data stream is received at a computer, the data streamincluding data representative of events. Rules are applied to the datastream for sorting data representative of events and for taking anaction based on a specified event.

[0012] The foregoing objects of the present invention are also achievedby an article including at least one sequence of machine executableinstructions. A medium bears the executable instructions in machinereadable form, wherein execution of the instructions by one or moreprocessors causes the one or more processors to receive at least onedata stream at a computer, the data stream including data representativeof events. The processors apply rules to the data stream for sortingdata representative of events and for taking an action based on aspecified event.

[0013] The foregoing objects of the present invention are also achievedby a computer architecture for monitoring an incoming data stream forspecified events. The computer architecture includes receiving means forreceiving at least one data stream at a computer, the data streamincluding data representative of events. The computer architecture alsoincludes applying means for applying rules to the data stream forsorting data representative of events and for taking an action based ona specified event.

[0014] The foregoing objects of the present invention are also achievedby a computer system including a processor and a memory coupled to theprocessor, the memory having stored therein sequences of instructions,which, when executed by the processor, causes the processor to performthe following steps. At least one data stream is received at a computer,the data stream including data representative of events. Rules areapplied to the data stream for sorting data representative of events andfor taking an action based on a specified event.

[0015] Still other objects and advantages of the present invention willbecome readily apparent to those skilled in the art from followingdetailed description, wherein the preferred embodiments of the inventionare shown and described, simply by way of illustration of the best modecontemplated of carrying out the invention. As will be realized, theinvention is capable of other and different embodiments, and its severaldetails are capable of modifications in various obvious respects, allwithout departing from the invention. Accordingly, the drawings anddescription thereof are to be regarded as illustrative in nature, andnot as restrictive.

BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The present invention is illustrated by way of example, and notby limitation, in the figures of the accompanying drawings, whereinelements having the same reference numeral designations represent likeelements throughout and wherein:

[0017]FIG. 1 is a high level block diagram of a computer system usablewith the present invention;

[0018]FIG. 2 is a block diagram of an exemplary network architectureusable with the present invention;

[0019]FIG. 2A is a schematic illustration of various event streamobjects usable in the present invention;

[0020]FIG. 3 is an illustration of events being ingested by a presenceand sorted using rules and actions into streams;

[0021]FIG. 4 is an illustration of an event explorer window;

[0022]FIG. 5 is an illustration of a stream rules/criteria window;

[0023]FIG. 6 is an illustration of a stream actions/matched taskswindow;

[0024]FIG. 7 is an illustration of a stream management/general window;

[0025]FIG. 8 is an illustration of a stream management/substreamswindow;

[0026]FIG. 9 is an illustration of an event search window; and

[0027]FIG. 10 is an illustration of an event display stream.

BEST MODE FOR CARRYING OUT THE INVENTION

[0028] A method and apparatus for monitoring of incoming data streamsand sorting the incoming data streams into event streams according tothe present invention are described. In the following detaileddescription, for purposes of explanation, numerous specific details areset forth in order to provide a thorough understanding of the presentinvention. It will be readily apparent, however, that the presentinvention may be practiced without these specific details. In otherinstances, well-known structures and devices are shown in block diagramform in order to unnecessarily obscure the present invention.

HARDWARE OVERVIEW

[0029]FIG. 1 is a block diagram illustrating an exemplary computersystem 100 upon which an embodiment of the invention may be implemented.The present invention is usable with currently available personalcomputers, mini-mainframes and the like. The computer system 100 can bea “presence” as described below.

[0030] Computer system 100 includes a bus 102 or other communicationmechanism for communicating information, and a processor 104 coupledwith the bus 102 for processing information. Computer system 100 alsoincludes a main memory 106, such as a random access memory (RAM) orother dynamic storage device, coupled to the bus 102 for storinginformation and instructions to be executed by processor 104. Mainmemory 106 also may be used for storing temporary variables or otherintermediate information during execution of instructions to be executedby processor 104. Computer system 100 further includes a read onlymemory (ROM) 108 or other static storage device coupled to the bus 102for storing static information and instructions for the processor 104. Astorage device 110, such as a magnetic disk or optical disk, is providedand coupled to the bus 102 for storing information and instructions.

[0031] Computer system 100 may be coupled via the bus 102 to a display112, such as a cathode ray tube (CRT) or a flat panel display, fordisplaying information to a computer user. An input device 114,including alphanumeric and other keys, is coupled to the bus 102 forcommunicating information and command selections to the processor 104.Another type of user input device is cursor control 116, such as amouse, a trackball, or cursor direction keys for communicating directioninformation and command selections to processor 104 and for controllingcursor movement on the display 112. This input device typically has twodegrees of freedom in two axes, a first axis (e.g., x) and a second axis(e.g., y) allowing the device to specify positions in a plane.

[0032] The invention is related to the use of a computer system 100,such as the illustrated system, to display enterprise architectureinformation. According to one embodiment of the invention, enterprisearchitecture information and display is provided by computer system 100in response to processor 104 executing sequences of instructionscontained in main memory 106. Such instructions may be read into mainmemory 106 from another computer-readable medium, such as storage device110. However, the computer-readable medium is not limited to devicessuch as storage device 110. For example, the computer-readable mediummay include a floppy disk, a flexible disk, hard disk, magnetic tape, orany other magnetic medium, a CD-ROM, any other optical medium, punchcards, paper tape, any other physical medium with patterns of holes, aRAM, a PROM, an EPROM, a FLASH-EPROM, any other memory chip orcartridge, a carrier wave embodied in an electrical, electromagnetic,infrared, or optical signal, or any other medium from which a computercan read. Execution of the sequences of instructions contained in themain memory 106 causes the processor 104 to perform the process stepsdescribed below. In alternative embodiments, hardwired circuitry may beused in place of or in combination with computer software instructionsto implement the invention. Thus, embodiments of the invention are notlimited to any specific combination of hardware circuitry and software.

[0033] Computer system 100 also includes a communication interface 118coupled to the bus 102. Communication interface 108 provides a two-waydata communication as is known. For example, communication interface 118may be an integrated services digital network (ISDN) card or a modem toprovide a data communication connection to a corresponding type oftelephone line. As another example, communication interface 118 may be alocal area network (LAN) card to provide a data communication connectionto a compatible LAN. In the preferred embodiment communication interface118 is coupled to a virtual blackboard. Wireless links may also beimplemented. In any such implementation, communication interface 1 18sends and receives electrical, electromagnetic or optical signals whichcarry digital data streams representing various types of information. Ofparticular note, the communications through interface 118 may permittransmission or receipt of the enterprise architecture information. Forexample, two or more computer systems 100 may be networked together in aconventional manner with each using the communication interface 118.

[0034] Network link 120 typically provides data communication throughone or more networks to other data devices. For example, network link120 may provide a connection through local network 122 to a hostcomputer 124 or to data equipment operated by an Internet ServiceProvider (ISP) 126. ISP 126 in turn provides data communication servicesthrough the world wide packet data communication services through theworld wide packet data communication network now commonly referred to asthe “Internet” 128. Local network 122 and Internet 128 both useelectrical, electromagnetic or optical signals which carry digital datastreams. The signals through the various networks and the signals onnetwork link 120 and through communication interface 118, which carrythe digital data to and from computer system 100, are exemplary forms ofcarrier waves transporting the information.

[0035] Computer system 100 can send messages and receive data, includingprogram code, through the network(s), network link 120 and communicationinterface 118. In the Internet example, a server 130 might transmit arequested code for an application program through Internet 128, ISP 126,local network 122 and communication interface 118.

[0036] The received code may be executed by processor 104 as it isreceived, and/or stored in storage device 110, or other non-volatilestorage for later execution. In this manner, computer system 100 mayobtain application code in the form of a carrier wave.

[0037] As depicted in FIG. 2, a network usable with the presentinvention includes a presence 150, a computer system 160 and a computersystem 170 connected to a network such as the Internet. The networkillustrated in FIG. 2 can also be called a virtual space. Other types ofnetworks such as local area networks, wide area networks and the likecan also be used with the present invention. The presence 150 includesthe computer software used in the present invention. Other computersystems including the depicted computer systems 172 and 174 generatemessage traffic which is sent to presence 150. The presence 150 isexpecting the event stream sent by the gatherer agent to be of apredetermined format. The presence 150 is configured to be able to usethis native format information and, if necessary, perform atransformation. The information sent by a gatherer agent should haveinformation such

[0038] Computer system 160 includes an illustrated hunter agent 175 anda message database 180. The hunter agent 175 is sent by the presence 150to the computer system 160. The message database 180 can receiveinformation from many sources such as the illustrated satellite link.Functionally, an agent is computer software, transportable over acomputer network from one computer to another, to implement a desiredfunction on the destination computer. An agent can also be defined as atransferable self-contained set of executable code instructions. Thehunter agent 175 uses information contained in the message database 180to create and send an event stream object (ESO) 182 to the presence 150.A relationship 184 exists between the ESO 182 and the message database180. The hunter agent 175 have to go out and look for informationcontained in databases throughout the network. The hunter agent cantransform the events into a standardized format for use by the presencewhich can include at least some of the following information associatedwith each event: type, title, datetime, keywords, summary, priority, andduration.

[0039] Computer system 170 includes an illustrated gatherer agent 190and a database 195. The gatherer agent 190 is sent by the presence tothe computer system 170. The database 195 can receive information frommany sources such as the illustrated satellite link. The gatherer agent190 sends information to the presence 150. The gatherer agent 190 relaysinformation to the presence in a native format as the information isupdated at the database 195. The events will have at least some of thefollowing information associated with each event: type, title, datetime,keywords, summary, priority, and duration.

[0040] There are three basic types of event stream object production asused by a cluster of presence entities, as illustrated in FIG. 2A.

[0041] The first, “Hunter Dynamic” 200, depicts the extraction of eventinformation from a legacy data source. In this case, an event streamobject specialized 202 to the particular legacy data type is created torepresent the data source record. This specialized object 202 retains apointer back to the original record, allowing it to extract additionalinformation and update information as appropriate.

[0042] The second, “Hunter Static” 204, also depicts the extraction ofevent information from a legacy data source. In this case, however, ageneric event stream object 206 is created and the standard informationelements are “filled in” as appropriate.

[0043] Third, the “Gatherer” approach shows the identification of newlycreated information in “new development” data sources 208. In this case,it is assumed that the information objects 210 were developed with thestandard event stream interface 212 and elements in mind, and can thusbe used by the presence with no additional modification.

[0044] Finally, the diagram depicts each of the event stream objectsbeing sent to a top-level presence entity 150 for its use, and anydelegated use by subordinate presence objects.

[0045] As illustrated in FIG. 3, events sent by computer systems 160,170, 172, 174 to the presence 150. Preferably, the events or eventstreams sent by the computer systems 160, 170, 172, 174 are in astandardized format and include the information listed above for thehunter 175 and gatherer 190 agents. It may be necessary to have separatecode at the presence 150 for standardizing the incoming message traffic.The presence 150 includes the inventive computer software for applyingrules and taking actions of the events ingested by the presence 150 andsorting the ingested events into streams of events 220, 222, 224. Onlythree streams are depicted although the present invention is not limitedto any specific number of streams. Events received by a presence areusually organized into logical groupings known as streams. These streamscan be used to systematize information. The stream names are devised bythe user and events are moving onto streams through the automaticapplication of rules created by the user.

[0046] With the previous description in mind, before describing thepresent invention in further detail, some paradigms and definitions areprovided. Because of the popularity of “desktop metaphor” userenvironments such as Apple's Macintosh and Microsoft's Windows, mosteveryone is familiar with the spatial visualization of hierarchicalorganizations as “documents” contained within “folders”. Like filecabinets in the real world, such an organization can be effective if theuser has a limited quantity of fairly static information.

[0047] As the information the user handles becomes increasingly“active”, the user must spend a greater amount of his or her timemanaging the organization—removing outdated information, filing freshlyreceived reports and organizing new assignments.

[0048] The present invention replaces the static spatial metaphor withone based on a dynamic temporal flow. In the present invention,information is presented as events spread over a timeline with a past,present and future. This organization provides the user with an “as ithappens” record of the things that occur, tasks assigned to the user andactions taken by the user.

[0049] Event and streams are manipulated with a set of commands thatmake it easy to organize, analyze, and exploit the information thatmakes up the virtual world of the user. The building blocks of thepresent invention—Presence, Event and Stream are discussed below.

Event

[0050] An event represents something that happened in the “real” world.The event can be a value received from a sensor, results from an expertsystem analysis, a work assignment from a supervisor or a request from aco-worker that the user approve a decision.

[0051] An event is composed of a number of standardized elements; italso allows for an infinite variety of extensions specific to the“something” that it represents. An example of an event summary isillustrated in FIG. 4 as the event summary display. The following arestandardized elements of an event:

[0052] A Type—the type of event.

[0053] Title—the “name” of the event.

[0054] Datetime—an event “happens” at a particular date and time.

[0055] Keywords—a list of words that describe the event.

[0056] Summary—a brief overview of the information in the event.

[0057] Priority—the importance of an event; there are five levelsdescribed.

[0058] Duration—the length of time that an event occurred (optional).

[0059] An event also has a standardized set of operations that can beperformed on it. These are:

[0060] Copy—add a reference to the event to some other presence.

[0061] Move—move the current event reference to some other presence.

[0062] Delete—remove the current event reference.

[0063] Display—display the full information represented by the event.

[0064] In addition to these operations, event types can define customoperations that can be performed on a given event. In the case of anevent representing the arrival of a mail message, possible extendedoptions could be to “Reply” or “Forward” it. An event representing the“crash” of a computer system could offer the user extended optionsrelated to dealing with it, such as “Attempt Restart” or “Submit ServiceOrder”. Events representing occurrences with a geo-spatial dimension,such as power outage reports, could offer the user extended optionsrelating to charting their location on a map.

Presence

[0065] A presence represents an individually identifiable entity withinthe virtual space. The user is a presence, as are co-workers.Organizational departments such as maintenance or publications couldalso be represented by a presence. Although only one presence isdepicted in FIG. 2, there can be many presences in the virtual space.

[0066] A presence is the basic unit for external interaction orcollaboration within the virtual space. The user receives informationand assignments from other presence entities. Should the user want tosend information or a request elsewhere, the user targets a presence toreceive the information.

[0067] A presence is working all the time, whether the user is logged onto a computer or not. The presence is always available to receive andact on incoming events. When an event is received by the presence, itfollows instructions that help the presence to determine what, ifanything, to do with the event. These instructions are called rules andare made from two components: criteria and actions.

[0068] Criteria are simple statements that examine the values of thestandardized data elements in the event. An example of a criteriastatement might be “Type is equal to Lightning Strike”. A rule can havemany individual criteria statements, and a rule can require that eitherall, any, or none of the individual criteria statements be satisfied.Examples of stream rules are depicted in FIG. 5.

[0069] Using a rule, after the processor 104 in presence 150 hasdetermined that the criteria have been met for a particular event,actions can then be performed. Actions are commands that the presence150 can perform to help filter, organize, and exploit information sentby the hunter agent 175, gatherer agent 190 and other incoming messagetraffic from computer systems 172, 174. Organizational actions let theuser file incoming information in the user's personal organizationalscheme. For example, streams 220, 222, 224 in FIG. 3 can be stored inseparate files. As illustrated in FIG. 4, there are five separate filesassociated with five sorted streams: zone 1 issues, zone 2 issues, zone3 issues, resource requests and local resource schedules. Other actionsallow the user to have the information automatically brought to theuser's attention with various notification mechanisms such as alertwindows, flashing icons, email or beeper notification as depicted inFIG. 6.

[0070] The user interacts with the computer software of the presentinvention through a graphical user interface (GUI) application. The GUIis a tool for organizing and browsing information sent to the user's“presence”.

[0071] When the user first launches the computer software of the presentinvention, a window like the one illustrated in FIG. 4 will appear. Thiswindow has seven areas: Toolbar, Summary Panel, Event Size Controls,Timeline Scaling Controls, Time Progression Mode Control, Highlight TimeDisplay and the EventStream Display.

[0072] Selecting the “setup” menu in FIG. 4 offers the user threechoices: Stream Rules (FIGS. 5 and 6), Stream Management (FIGS. 7 and 8)and Preferences. The first two choices “Stream Rules” and “StreamManagement” are discussed below.

[0073] The Preferences choice brings up a window allowing the user toconfigure, for example, ease-of-use (e.g., keyboard shortcuts) andcosmetic (e.g., window color) features.

Stream Rules

[0074] Selecting “stream Rules” brings up a window like the one shown inFIG. 5. The window illustrated in FIG. 5 allows the user to create ruleswhich check each event received in the data stream against criteria. Ifall criteria are matched then matched actions (FIG. 6) are performed;likewise a failure to match all criteria can cause unmatched actions tobe performed. The criteria are formed by simple pattern matchingstatements allowing the user to compare the contents of fields in eachevent with values selected by the user. These statements allow the userto, for example, check the type of event, time it occurred, and thecontents of the event's keyword list.

[0075] The actions that can be performed in the “Matched” or “Unmatched”cases include placing an event on one or more streams, informing theuser via alert or sound, or deleting the event. Other operationsappropriate to your environment may be available as well.

[0076] Selecting “Streams Management” from the “Setup” menu will openthe window illustrated in FIG. 7 to appear. In this window, the user canset preferences for each stream. With a stream selected in the leftmostlist, the user can set general preferences for the stream and create,edit or modify display substreams (FIG. 8) for the stream. Displaysubstreams are simply a means available to “declutter” a display ofevents within a stream.

Toolbar

[0077] The toolbar offers five commands. The five commands are:

[0078] Back—Shift stream display to show older events.

[0079] Go To—Shift stream display to center a particular time on thedisplay.

[0080] Forward—Shift stream display to show more recent events.

[0081] Search—Search the stream for events matching some criteria.

[0082] New—Create a new event and place it on a stream.

[0083] Pressing “Go To” pops up a menu where the user can either centerthe current time on the display (the default action), or enter adatetime to center the display on.

[0084] Pressing “New” pops up a menu where the user can select a type ofevent to be created. Once the user makes a selection, the event will becreated, and a window will be created to specify the event information.The event types available and the interface used to specify them willvary from system to system.

Search

[0085] Pressing “Search” brings up a window like the one illustrated inFIG. 9. Within this window, search criteria can be entered to locate aparticular event. Pressing “Find” will cause the computer software tofocus on the desired event. If more than one matching event is found,repeatedly selecting “Find” will bring each up in succession.

Event Summary Display

[0086] The output of the sorted, selected and displayed event streams isdepicted in the Event Stream Display in FIG. 10. The top part of thedisplay is the Stream Selection area and allows the user to select astream to be displayed. There can only be one stream selected. If theuser has more streams than can be displayed in the Stream Selectionarea, the Stream Title Navigation Controls will be active, allowing theuser to move within a list of stream titles.

[0087] The titles displayed in the Stream Selection area may presentcues to any unacknowledged priority events within the stream. The colorcoding (black, yellow and red) indicates increasing levels ofsignificance. If the title itself is yellow or red, it means that thereis a priority event within the “current time” window. The size of thiswindow is configurable via the “Streams Management” window inillustrated in FIG. 7. Similarly, colored markers before or after thetitle text indicates the presence of unacknowledged priority eventsbefore or after the current time window.

[0088] Immediately below the Steam Selection area is where events aredisplayed. A stream can have several substreams, and the display in FIG.10 illustrates a stream with two substreams.

[0089] The Current Time Indicator shows the user where the current timeis centered on the display. The default location for this indicator(useful when using the “Now” toolbar command) can be moved from side toside by using the small square handles at the ends of the indicator.

[0090] It will be readily seen by one of ordinary skill in the art thatthe present invention fulfills all of the objects set forth above. Afterreading the foregoing specification, one of ordinary skill will be ableto affect various changes, substitutions of equivalents and variousother aspects of the invention as broadly disclosed herein. It istherefore intended that the protection granted hereon be limited only bythe definition contained in the appended claims and equivalents thereof.

What is claimed is:
 1. A method for monitoring an incoming data streamfor specified events, comprising: receiving at least one data stream ata computer, the data stream including data representative of events; andapplying rules to the data stream for sorting data representative ofevents and for taking an action based on a specified event.
 2. Themethod of claim 1, comprising displaying events associated with aselected data stream on a time line.
 3. The method of claim 1,comprising gathering data at a remote location and placing the gathereddata in a data stream and forwarding the data stream to the computer. 4.The method of claim 3, wherein said gathering step is performed by anagent.
 5. The method of claim 1, comprising hunting for predetermineddata at a remote location and placing the hunted data in a data streamand forwarding the data stream to the computer.
 6. The method of claim5, wherein said hunting step is performed by an agent.
 7. The method ofclaim 5, comprising normalizing the data before the data is placed inthe data stream.
 8. The method of claim 1, wherein the at least one datastream includes message traffic.
 9. The method of claim 5, comprisinglinking the hunted data with a location where the hunted data waslocated.
 10. The method of claim 9, comprising updating the receivedhunted data with new hunted data as new data is received at the hunteddata location.
 11. The method of claim 6, comprising constructing anevent stream object which is forwarded to the computer by the agent. 12.The method of claim 11, wherein the event stream object includesinformation descriptive of an event.
 13. The method of claim 12, whereinthe information includes at least one of the following: the time thatthe event occurred; the duration that event covered; and key words thatdescribe the event.
 14. The method of claim 1, comprising filing thesorted information in separate data stream files.
 15. The method ofclaim 1, wherein an event is comprised of at least one of the followingelements: type, title, datetime, keywords, summary, priority andduration.
 16. The method of claim 1, wherein a rule includes a criteriacomponent and an action component.
 17. The method of claim 16, whereinthe criteria component includes at least one criteria statement and tosatisfy a rule either all, any or none of the at least one criteriastatements need to be satisfied.
 18. The method of claim 17, wherein atleast one action is taken if the at least one rule is satisfied.
 19. Themethod of claim 1, wherein the data in the event data stream is receivedin a standardized format.
 20. The method of claim 14, comprisingdisplaying an event stream using information stored in stored datastream files.
 21. The method of claim 20, comprising displaying an eventstream using a received sorted data stream.
 22. An article comprising:at least one sequence of machine executable instructions; a mediumbearing the executable instructions in machine readable form, whereinexecution of the instructions by one or more processors causes the oneor more processors to: receive at least one data stream at a computer,the data stream including data representative of events; and apply rulesto the data stream for sorting data representative of events and fortaking an action based on a specified event.
 23. The article of claim22, comprising causing the processor to display events associated with aselected data stream on a time line.
 24. A computer architecture formonitoring an incoming data stream for specified events, comprising:receiving means for receiving at least one data stream at a computer,the data stream including data representative of events; and applyingmeans for applying rules to the data stream for sorting datarepresentative of events and for taking an action based on a specifiedevent.
 25. The computer architecture of claim 24, comprising displayingmeans for displaying events associated with a selected data stream on atime line.
 26. A computer system, comprising: a processor; and a memorycoupled to said processor, the memory having stored therein sequences ofinstructions, which, when executed by said processor, causes saidprocessor to perform the steps of: receiving at least one data stream ata computer, the data stream including data representative of events; andapplying rules to the data stream for sorting data representative ofevents and for taking an action based on a specified event.
 27. Thecomputer system of claim 26, comprising causing the processor to displayevents associated with a selected data stream on a time line.